Security Vulnerability in Remote Cache Extensions for Build Systems by Major Cloud Vendors

CVE-2025-36852

What is CVE-2025-36852?

A significant security vulnerability exists in remote cache extensions utilized by common build systems. This flaw enables contributors with pull request privileges to inject compromised artifacts from untrusted environments into trusted production settings undetected. The issue arises from a failing in the 'first-to-cache wins' design principle, which allows malicious artifacts built in untrusted environments—like feature branches or pull requests—to poison the cache utilized by secure environments. This vulnerable process completely sidesteps established security measures, such as encryption, access controls, and checksum validations, as the cache poisoning occurs during the artifact construction phase, prior to the implementation of any protective measures.

References